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Among different heavy liquid metals (HLMs), lead-bismuth eutectic (LBE) is considered at present as a po- 
tential candidate for the coolant of new generation fast reactors (critical and subcritical) and for liquid spallation 
neutron sources and accelerator driven systems (ADS). A high temperature liquid LBE loop, KYLIN-II-M, 
has been built to study the characteristics of corrosion and fluidity of LBE at the Institute of Nuclear Energy 
Safety Technology. However, due to the sensors and execution components of the loop work at high temper- 
atures and in severely corrosive environments, the reliability and security of the data acquisition and control 
system (DACS) of KYLIN-II-M face challenges during the loop operation. In order to meet the urgent needs for 
KYLIN-I-M’s long-term stable operation, a virtualization and redundancy control system has been developed. 
The onsite operation result shows that the DACS is stable and reliable. In this paper, the experimental results 


are described in detail. 
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I. INTRODUCTION 


In order to study lead-bismuth eutectic (LBE) related tech- 
nologies, a multifunction LBE loop named KYLIN-II-M 
has been built at the Institute of Nuclear Energy Safety 
Technology of Chinese Academy of Sciences and operated 
since 2013. It aimed at the corrosion, oxygen measurements, 
and control tests for the LBE fast reactor [1]. The loop is char- 
acterized by the “8” structure with forced circulation driven, 
as shown in Fig. 1. It consists of a molten tank, a storage tank, 
a flow meter, a pump, a cooler, a heater, a heat exchanger, an 
oxygen control facility, and three experimental sections etc. 
Compared to other LBE loops [2-4], the specialty of KYLIN- 
II-M is its operating temperature which can reach 800 °C and 
its continuous running time which is over 10 000 h. 
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Fig. 1. The structure block diagram of KYLIN-II-M. 


To guarantee that the high temperature LBE loop is operat- 
ing normally, process variables(such as flow, pressure, liquid 
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level and temperature), control valves, and other components 
must be monitored in real time. Even though the LBE loop 
is a non-nuclear facility, a high performance of safety, sta- 
bility and reliability is necessary. In order to meet the re- 
quirements of the experiment, a data acquisition and control 
system (DACS) based on a programmable logic controller 
(PLC) and a data acquisition card system was developed. In 
this system, the PLC is applied to measure the low frequency 
signal of the sensors and control execution components. In 
the meantime, the data acquisition card system is designed to 
measure the high frequency signal of the sensors. 


Most DACSs of existing LBE loops are developed based 
on PLC systems and “one point to one point” hardware mea- 
surement and control technologies [5, 6]. However, when a 
problem with the I/O port occurs, the overall system may mal- 
function. It will affect the normal and secure operation of the 
LBE loop. In addition, there are also lots of DACSs which 
are based on data acquisition card systems [7, 8]. Although 
hardware redundancy technology is adopted to reach the re- 
quirements of a DACS’s operation reliability, it will not mon- 
itor and control the LBE loop flexibly. Due to the fact that 
the data acquisition system usually has no CPU and storage 
module, when the monitored computer is down, the system 
will not work normally. 


Redundancy control and virtualization technologies have 
been used in the DACS of KYLIN-II-M. Redundancy control 
technology can not only largely improve the DACS’s reliabil- 
ity, but also can set the base for system expansion. The vir- 
tualization technology based on the database server can real- 
ize centralized management and storage of experimental data 
whilst the virtual desktop infrastructure (VDI) based virtual- 
ization technology could control the LBE loop via different 
operation terminals at different times. Thus, once one moni- 
toring computer is shut down, another can gain access control 
to ensure system reliability and operational integrity. 


010401-1 


YAO Chuan-Ming et al. 


VDL system 


Data backup server 


Virtual laboratory 


User interfaces 


Data processing 


Main DACS 


PLC station Profibus-DP 


VD20 


ET200 ET200 ET200 


Nucl. Sci. Tech. 26, 010401 (2015) 


Web client 


Router and firewall 


Fault diagnosis system 


Display terminal 
LAN 


a 
OPC server 
Database server 


LAN 


PXI system 


Fig. 2. The architecture of the DACS for KYLIN-II-M. 


TABLE 1. The main design parameters of the DACS 


Type Parameter Value 
Main data acquisition and control No. of digital input channels 
No. of analog output channels 16 
No. of digital input channels 240 
No. of digital output channels 240 
Power of UPS (Uninterrupted Power Supply) 60kWh 
Sampling rate for main data acquisition >2Hz 
Data processing system Communication bandwidth > 1 Gbit/s 
Capacity of data storage TAT 
No. of processor cores 16 
User interface system No. of virtual machine 20 
No. of display terminal 36 
Virtualization laboratory Capacity of data backup storage 3.0 T 


II. GENERAL DESCRIPTION 


The main requirements of the DACS for the KYLIN-II- 
M are remote monitoring and controlling in the central con- 
trol room. When experiments start-up, an initial process will 
be done to self-check 562 data acquisition channels and 123 
digital output channels. In addition, 7 analog output chan- 
nels are required to control the electrically operated valve 
(EOV). A large amount of measurement data is stored in the 
database server in string format using structured query lan- 
guage (SQL) [9] statements during the operation of the loop. 
The transmission bandwidth is estimated to be as large as 
100MB. All the operational parameters can meet the system 
requirements. 


Major functions of the DACS are as follows: 


— To acquire the experimental data from the field sensors, 


including all sensors signals, fault signals, environmental sig- 
nals and operation parameters. 


— To control the equipment of the loop, including all exe- 
cution components (EOV, solenoid valve and vacuum pump, 
etc.), the pump, the heat exchanger, the insulation system and 
the gas system, etc. 


— To realize online fault detection and fault diagnosis. In 
order to effectively avoid accidents caused by operation er- 
rors , a fault tolerant control and interlock protection program 
should be developed as well. 


— To design a VDI system. 


— To support remote access and control, a virtual digital loop 
(VDL) of the loop was developed to simulate LBE loop oper- 
ating conditions in real time. 
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Il. THE DACS ARCHITECTURE 


The DACS of KYLIN-II-M consists of a main DACS, a da- 
ta processed system, a user interface system and a virtual lab- 
oratory. The architecture of the DACS is presented in Fig. 2. 
Communication between each system is done via local area 
network (LAN). 

The main design parameters of the DACS for KYLIN-II-M 
are listed in Table 1. The number of designed I/O ports has 
more than 10% channel allowance to ensure that the system 
be extensible and easily-updated. 


A. The main DACS 


The main DACS hardware consists of Siemens S7-300 se- 
ries PLC modules, NI PXI series modules and an alarm sys- 
tem. The architecture of the main DACS is a distribution and 
centralization system (DCS). Some independent systems such 
as driven, heater and oxygen control systems are distributed 
on site and used as field ET200 substation systems for the 
PLC master station. This considerably reduces the distance 
of signal transmission, thus signal detection capabilities are 
improved. 

For the low speed data acquisition and logic control of the 
loop, PLC AI and DI modules were used. Their advantage in- 
cludes support from comparative self-contained software and 
hardware systems, cost-effectiveness and reliability, and es- 
pecially anti-environment disturbance ability. For the high 
speed data acquisition system, PXI series data acquisition 
cards have been used to collect high frequency signals in the 
dynamic measurement experiment. To adequately preserve 
the shape of the signals, it should sample at a much higher 
rate than the Nyquist frequency. Thus, the sample rate of the 
DACS is 5 times the maximum frequency component of the 
signals. 

In order to guarantee operation safety and reliability of the 
loop, an alarm system has been developed. It consists of a 
fault detection system, a fault diagnosis system and a safety 
interlock system. First of all, the definition and classification 
of fault is shown in table 2. Fault classification “A” is se- 
rious accidents, fault classification “B” is normal accidents, 
and fault classification “C” is minor accidents. The system 
should be shut down as soon as possible when a serious ac- 
cident occurs. Figure 3 shows the steps of the system shut- 
down process in a flow chart. In consideration of the oper- 
ational integrity of KYLIN-II-M, when a minor accident oc- 
curs, the system should keep alarming unless the failure is 
recovered but not shutdown. However, due to the existence of 
the noise, it affects the DACS reliability of fault detection and 
estimate. To solve this problem, a multipoint measurement 
system, safety barrier and isolator were used. Different alarm 
modules, such as text alarms, voice alarms, GSM alarms and 
web distribution alarms, have been developed as well. A no- 
ticeable feature of the alarm system is the GSM alarm which 
will send text messages to registered cell phones when an ab- 
normal status of the loop is detected. 
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B. Data processing system 


The data processing system consists of a database server, 
two LAN exchangers and a VDI system. A large amoun- 
t of data will be recorded in the database server in real time. 
Experimental data and diagnostic data will transfer to the data 
processing system through the LAN. The VDI system enables 
the distribution of 20 virtual workstations for researchers. 
Thus, 20 virtual machines (VMs) were developed. 

By using the virtualization technology, each workstation 
can gain 2 processor cores, 128 GB memory, and two pieces 
of 300 GB 15 K SAS hard disk. Two repositories are 
configured: the core repository for the system data and the 
platform-specific repository for the workstation buffer. Each 
device transfers data through a 1 GB Ethernet adapter running 
in full-duplex mode. 

An OPC server [10] was developed as a shared database 
server and it can enable data distribution to anyone connected 
to the system through LAN. The remote client and server ap- 
plication use OPC Unified Architecture (OPC UA) client and 
server application programming interface (API) to exchange 
data, respectively. 


C. User interface system 


The user interface system has developed 20 VMs for re- 
searchers in the central control room. While the data process- 
ing system distributes 20 virtual workstations and 20 VMs, 
all these should be monitored and controlled in a remote cen- 
tral control room, as well. The user interface system of the 
loop is designed and constructed with the aid of LAN. All ex- 
periment data can be displayed and monitored in this system. 
20 virtual desktops (VD) were designed to monitor the loop 
operation. Note that the VDs can be switched. Thus, when 
the primary monitored computer is shut down, the standby 
VD will gain access control to ensure the system reliability 
and operational integrity. In this process of control, watchdog 
technology has been used. The instructions for transfering 
between the primary and the standby computers are present- 
ed in Fig. 4. When the primary monitored VD is working 
normally, it periodically sends reset instructions to the stand- 
by VD. Then the standby VD will be periodically reset and 
the control program will not be executed. However, if the 
primary VD fails, the transfer of reset instructions is aborted. 
Thus, the standby VD will execute the control program and 
gain control of the DACS. 


D. Virtual laboratory 


The virtual laboratory system consists of a virtual digital 
loop (VDL) that enables a three dimensional loop structure 
model of the loop be displayed, simulated, and analyzed, a da- 
ta backup server to backup data online, a fault diagnosis sys- 
tem to remote analyze the related data which is pre-defined 
as fault data, and a web client to distribute experimental da- 
ta and monitor the operation of the loop. The data from the 


010401-3 


m= 


06 


| 


2 
J 


af 


r) 
"2 


IV: 


YAO Chuan-Ming et al. 


ChinaX iv (ERAT! 


Nucl. Sci. Tech. 26, 010401 (2015) 


TABLE 2. The main design parameters of the DACS 


Detection probe and pressure gauge 
Smoke-actuated and flame actuated sensor 
Current mode leakage protector 

K or N thermocouple 


Pressure gauge 
Liquid level detection probe 
Flow meter 


Fault Definition of fault Fault classification The way of detection 
LBE leakage Leakage signals “ON” A 
Fire disaster Fire signal > 8mA A 
Electric leakage Leakage current> 6mA A 
Temperature anomaly Set temperature> 30°C A 
Pressure anomaly > Maximum pressure B 
Liquid level anomaly Tirgger the probe B 
Flow anomaly > Maximum flow C 
Misoperation Mistake operation C 
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Fig. 3. Flow chart of fault diagnosis. 


virtual laboratory comes from the OPC server through LAN physics calculation and simulation system. 


communication interfaces. 


The VDL has been established with the application of 
computer virtualization technology, graphics processing and 
Ethernet. For the researchers of KYLIN-II-M, the VDL pro- 
vides more visual information. The pump system, the oxygen 
control system and the heater can be displayed in sequence 


In consideration of data security, the disaster recovery (DR) 


or simultaneously. However, the VDL is not only a virtual system is designed to increase reliability and availability of 
display system but also a high temperature liquid LBE loop experimental data. 
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Fig. 4. Instructions transfer between primary and standby computer. 


E. The software interface 


The DACS software is developed with configuration and 
graphical programming language. In order to efficiently de- 
velop some special system functions, Matlab and C language 
have been used. 


PLC software is developed by SIMATIC, as well as HMI 
(Human-Machine Interface), based on configuration software 
of WinCC and WinCC Flexible. LabVIEW, a graphical soft- 
ware development tool, provides another reason for choos- 
ing the PXI platform because LabVIEW enables code devel- 
opment by just writing graphical icons and greatly enhances 
productivity. 


Based on the above work, remote monitor software has 
been developed. The principles of the DACS software in- 
terface design are simplicity, support, accessibility and ver- 
satility. The DACS of the monitor software is presented in 
Fig. 5. It consists of five interfaces, each interface realiz- 
ing different functions. The main interface provides operators 
with the functions of experimental data display and key com- 
ponents control. In an emergency situation, some emergency 
measurements can be taken through the main interface. Gas 
valves and the subsystem (e.g. electromagnetic pump) can be 
controlled and monitored through the gas valve interface and 
subsystem interface. In the alarm interface, system alarm in- 
formation and parameters can be displayed and modified. In 
addition, the most recent data can be viewed with automatic 
refresh, in addition to viewing the historical data. 
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Fig. 5. (Color online) The main interface of the DACS software. 


IV. REDUNDANCY CONTROL SYSTEM 


To ensure the reliability of the DACS, the redundancy con- 
trol system was designed. Both redundant methods and re- 
dundancy are studied and analyzed so as to improve the re- 
liability and cost effectiveness of the DACS. Two redundant 
methods are established to research the effect of redundant 
methods on the reliability of the DACS. The schematic dia- 
gram of the two redundant methods is presented in Fig. 6. It 
consists of several control components Apn. As the influence 
of the intermediate is neglected, the reliability of the DACS 
can be calculated through the following formula 


n 


R(= | [[1-G-Ra@y], a) 


i=1 
n 2 
R(t) =1- í - IGO ; (2) 
i=1 


where, Rj(t) is the reliability of the series-connected af- 
ter parallel-connected system, R2(f) is the reliability of the 
parallel-connected after series-connected system, R4,(f) is the 
reliability of control component A; and 0 < Ry,(t) < 1. After 
numerical calculation, it can get the following result 


R(t) > R(t), (3) 


where, i is the number of control components and i > 
1. Thus, the redundant mode with parallel-connected then 
series-connected is designed. 

In order to study the relation between redundancy and reli- 
ability, the parallel control components model is established 
and presented in Fig. 6. When the life distributions of each 
component are exponential, the reliability of the control sys- 
tem can be calculated as 


R@)=1-(1-e J’, (4) 
where, 4 is the failure rate of the control component, and n is 
the redundancy of systems. Considering that the mean time 
between failures (MTBF) of the PLC component is nearly 
300 000h [11], the failure rate can be calculated as: 

MTBF = 3/22. (5) 


As MTBF = 300 000h, the failure rate 2 is 5.0 x 1076. 
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Fig. 6. Two redundant mode of redundancy control system. (a) 
Redundant mode with series-connected after parallel-connected, (b) 
Redundant mode with parallel-connected after series-connected. 
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Fig. 7. (Color online) The reliability of DACS. 
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Fig. 8. The block diagram of redundancy DACS for KYLIN-II-M. 


In this case, the reliability of the system under different re- 
dundancies will be presented, especially with the redundancy 
n = 1,2,3 and 4, as shown in Fig. 7. 

From Fig. 7, it is clear that reliability of the DACS im- 
proves as redundancy increases, but when n > 2, the relia- 
bility of the DACS will not improve significantly. When the 
redundancy n = 2 and after running 50000 h, the reliability is 
nearly 0.97, meeting the stability demand of the DACS. Thus, 
double redundancy is used in the DACS including redundant 
PLC CPU and functional modules. 

From the analysis above, using the double redundancy 
and redundant mode with series-connected after parallel- 
connected redundancy DACS is designed and presented in 
Fig. 8. Under the premise of meeting the requirements in 
safety and reliability, the redundancy DACS should be eco- 
nomically with minimized control components. The key con- 
trol components are applied to make experimental data reli- 
able in the case of a loop operation emergency. Experimental 
data is stored in local and remote database server to ensure 
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data security. The DACS employed a double redundant PLC 
CPU hot standby and functional modules (AI and DI mod- 
ules) design. As the hardware structure is simple and the two 
CPUs are connected by Ethernet, the safety and reliability of 
the DACS has been greatly enhanced. 


V. EXPERIMENTAL AND RESULTS 


The DACS has been operated for thousands of hours. 
Preliminary results such as temperature and flow rate have 
been obtained using analog input modules. The traditional 
survey temperature of the LBE method uses temperature sen- 
sors and puts these sensors on the pipe of the loop. In this way 
the measurement results may be inaccurate due to uneven heat 
transfer of the pipe. In order to overcome this problem, it is 
possible to take advantage of multi-point measuring. Then 
temperature average data of certain station measured will au- 
tomatically be computed through the DACS. The outlet tem- 
perature measurement and result is shown in Fig. 9. From 
Fig. 9, the average temperature may comparatively reflect the 
true temperature of LBE. The variation of temperature is less 
than 3 °C, it shows that the DACS is reliable and can meet 
the demand of loop operation. Meanwhile, the advantage of 
this measurement method is that in case of a temperature sen- 
sor failure, there are two remaining sensors to measure the 
temperature. 

The flow rate of LBE is measured by the Venturi Pitot tube 
flow meter. In order to make the Venturi Pitot tube work in 
a linear range, the pump current should not be less than 50 A 
and the flow rate of LBE is greater than 1 m?/h. The flow rate 
of LBE is measured at a temperature of 302 °C and is present- 
ed in Fig. 10. The results indicated that with the increasing 
value of pump current, the flow rate of LBE increased gently 
but did not indefinitely show a linear relationship. The main 
influence factor is the characteristics of pumping pressure. 

The liquid LBE level meter is used for local level measure- 
ment. It consists of an electrode, DC power and a signal- 
processing unit. Two states can be measured by using this 
method, namely the contact height has arrived or not. This 
kind of method is mostly simple, self made constructions. 
The contact electrode technique takes advantage of the good 
electrical conductivity of the LBE. If an initially open electric 
circuit stressed by a voltage of 24VDC is closed at the mo- 
ment where the liquid LBE surface makes contact with the 
spike of the electrode, the potential decreases. This can be 
captured by an optocoupler and the level translator. An opto- 
coupler was mainly used in isolation of the liquid level signal 
transmission and the level translators mainly met the trigger 
level requirement of the PLC DI modules. The signal from 
the liquid level was acquired by the PLC and PXI systems to 
ensure the level of the loop can be controlled below safe liq- 
uid level. In order to gather more information about the actual 
liquid level, it is necessary to install an array of these filling 
level meters. A sketch of such level meters and measurement 
results are shown in Fig. 11. 

To ensure the liquid level is controlled exactly and smooth- 
ly, three level meters are used in the control process. When 


010401-6 


DATA ACQUISITION AND CONTROL... 


(a) 


Qe 


Time (h) 


Fig. 9. (Color online) The outlet temperature measurement method and results of heater. (a) The graph of temperature distribution; (b) The 
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Fig. 10. (Color online) The flow rate of LBE test results. 


LBE reached the first level meter, the gas pressure was de- 
creased to limit LBE flow rate. Once LBE reached the sec- 
ond level meter, the gas valve was immediately closed. When 
LBE reached the third level meter, the DACS would trigger 
an alarm. 


VI. CONCLUSION 


The hardware architecture solution for the high tem- 
perature liquid LBE loop, KYLIN-H-M, was presented. 
Virtualization technologies successfully solved the prob- 
lem that the DACS is difficult to be monitored flexibly. 
Redundancy control improved the reliability of the DACS. 
The fault diagnosis has been designed to ensure security of 
the loop. The DACS has been operated thousands of hours 
and the results show that the DACS is reliable, flexible and 
secure. 

The DACS software will be optimized further in the future 
to satisfy the stability and seamless operation of the loop and 
the a new operating system (OS), such as Linux, will be em- 
ployed as well. 
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Fig. 11. The schematic of level meters and measurement results. (a) 
The schematic of liquid level measurement; (b) The results of liquid 
level measurement. 
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